diff --git a/nmap-service-probes b/nmap-service-probes index ec10bac3e..bee69e7de 100644 --- a/nmap-service-probes +++ b/nmap-service-probes @@ -6168,6 +6168,17 @@ match http m|^HTTP/1\.1 200 OK\r.*\nServer: Apache\r.*\nX-DellKACE-Appliance: (\ match http m|^HTTP/1\.1 401 Authorization Required\r\nDate: .*\r\nServer: Apache\r\nWWW-Authenticate: Digest realm=\"Sage Digital ENDEC\"| p/Apache httpd/ i|SAGE Digital ENDEC EAS/CAP receiver unit| cpe:/a:apache:http_server/ # APACHE +# First match these plaintext responses when SSL was expected +# Matching ssl/http stops probing. This line has plenty of match info. +match ssl/http m|^\n\n400 Bad Request\n\n

Bad Request

\n

Your browser sent a request that this server could not understand\.
\nReason: You're speaking plain HTTP to an SSL-enabled server port\.
\n.*

Apache/([\w._-]+) (.*) Server at ([\w._*-]+) Port \d+
|s p/Apache httpd/ v/$1/ i/$2; SSL-only mode/ h/$3/ cpe:/a:apache:http_server:$1/ +# These lines don't have a strong enough match, so we only match ssl and let Nmap start over inside the tunnel. +match ssl m|^\n\n400 Bad Request\n\n

Bad Request

\n

Your browser sent a request that this server could not understand\.
| p/Apache httpd/ i/SSL-only mode/ cpe:/a:apache:http_server/ +match ssl m|^HTTP/1\.1 400 Bad Request\r\n.*Server: Apache\r\n.*\n\n400 Bad Request\n\n

Bad Request

\n

Your browser sent a request that this server could not understand\.
|s p/Apache httpd/ i/SSL-only mode/ cpe:/a:apache:http_server/ +# Then look for detailed version info in the body which might be better quality than what's in the Server header. +match http m|^.*

Apache/([\d.]+) \([^)]+\) ?(.*) Server at ([-\w_.]+) Port \d+
\n\n|si p/Apache httpd/ v/$1/ i/$2/ h/$3/ cpe:/a:apache:http_server:$1/ +match http m|^.*
Apache/([\d.]+) \([^)]+\) Server at ([-\w_.]+) Port \d+
\n\n|si p/Apache httpd/ v/$1/ h/$2/ cpe:/a:apache:http_server:$1/ +match http m|^.*
Apache/([\d.]+) Server at ([-\w_.]+) Port \d+
\n\n|si p/Apache httpd/ v/$1/ h/$2/ cpe:/a:apache:http_server:$1/ +# Finally, look at the Server header. match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: Apache[/ ](\d[-.\w]+)\r.*\nX-Powered-By: PHP/([\w._-]+)\r\n|s p/Apache httpd/ v/$1/ i/PHP $2/ cpe:/a:apache:http_server:$1/ cpe:/a:php:php:$1/ match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: Apache\r.*\nX-Powered-By: PHP/([\w._-]+)\r\n|s p/Apache httpd/ i/PHP $1/ cpe:/a:apache:http_server/ cpe:/a:php:php:$1/ match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: Apache[/ ](\d[-.\w]+)\r.*\nX-Powered-By: ([^\r\n]+)\r\n|s p/Apache httpd/ v/$1/ i/$2/ cpe:/a:apache:http_server:$1/ @@ -6201,6 +6212,8 @@ match http m|^HTTP/1\.[01] \d\d\d.*\r\nDate:.*\r\nServer: Stronghold/([-.\w]+) A softmatch http m|^HTTP/1\.[01] \d\d\d.*\r\nDate:.*\r\nServer: Stronghold| p/Apache Stronghold httpd/ i/based on Apache/ cpe:/a:redhat:stronghold/ +match ssl/http m|^HTTP/1.1 400 Bad Request\r\n.*?Server: nginx/([\d.]+)[^\r\n]*?\r\n.*400 The plain HTTP request was sent to HTTPS port|s p/nginx/ v/$1/ cpe:/a:igor_sysoev:nginx:$1/ +match ssl/http m|^HTTP/1.1 400 Bad Request\r\n.*400 The plain HTTP request was sent to HTTPS port|s p/nginx/ cpe:/a:igor_sysoev:nginx/ match http m|^HTTP/1\.[01] \d\d\d.*\r\nServer: nginx\r\n| p/nginx/ cpe:/a:igor_sysoev:nginx/ match http m|^HTTP/1\.[01] \d\d\d.*\r\nServer: nginx/([\d.]+)\r\n|s p/nginx/ v/$1/ cpe:/a:igor_sysoev:nginx:$1/ match http m|^HTTP/1\.[01] \d\d\d.*\r\nServer: nginx/([\d.]+) \(Ubuntu\)\r\n|s p/nginx/ v/$1/ i/Ubuntu/ o/Linux/ cpe:/a:igor_sysoev:nginx:$1/ cpe:/o:canonical:ubuntu_linux/ cpe:/o:linux:linux_kernel/a @@ -6771,9 +6784,6 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nKONICA MINOLTA PageScope Web Connect match http m|^HTTP/1\.[01] \d\d\d .*\r\nDate: .*\r\nServer: Embperl/([\w.]+) Apache/([\w.]+) \(Fedora\)\r\n| p/Apache httpd/ v/$2/ i/Embperl $1; Fedora/ o/Linux/ cpe:/a:apache:http_server:$2/ cpe:/a:ecos:embperl:$1/ cpe:/o:fedoraproject:fedora/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.[01] \d\d\d .*\r\nDate: .*\r\nServer: Embperl/([\w.]+) Apache/([\w.]+) \(Debian GNU/Linux\) (.*)\r\n| p/Apache httpd/ v/$2/ i/Embperl $1; Debian; $3/ o/Linux/ cpe:/a:apache:http_server:$2/ cpe:/a:ecos:embperl:$1/ cpe:/o:debian:debian_linux:$3/ cpe:/o:linux:linux_kernel/ match http m|^HTTP/1\.[01] \d\d\d .*\r\nDate: .*\r\nServer: Embperl/([\w.]+) Apache/([\w.]+) \(Debian GNU/Linux\)\r\n| p/Apache httpd/ v/$2/ i/Embperl $1; Debian/ o/Linux/ cpe:/a:apache:http_server:$2/ cpe:/a:ecos:embperl:$1/ cpe:/o:debian:debian_linux/ cpe:/o:linux:linux_kernel/ -match http m|^.*<address>Apache/([\d.]+) \([^)]+\) ?(.*) Server at ([-\w_.]+) Port \d+</address>\n</body></html>\n|si p/Apache httpd/ v/$1/ i/$2/ h/$3/ cpe:/a:apache:http_server:$1/ -match http m|^.*<address>Apache/([\d.]+) \([^)]+\) Server at ([-\w_.]+) Port \d+</address>\n</body></html>\n|si p/Apache httpd/ v/$1/ h/$2/ cpe:/a:apache:http_server:$1/ -match http m|^.*<address>Apache/([\d.]+) Server at ([-\w_.]+) Port \d+</address>\n</body></html>\n|si p/Apache httpd/ v/$1/ h/$2/ cpe:/a:apache:http_server:$1/ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: SiteScope/([\d.]+) .*\r\n| p/Mercury SiteScope Application Managment httpd/ v/$1/ match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: \r\nDate: .*\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4\.01 Transitional//EN\">\n<html>\n<head>\n<title>OSBRiDGE (\w+) Login Page\n|s p/OSBRiDGE $1 router http config/ d/router/ match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: SilverStream Server/([\d.]+)\r\n\r\n|s p/SilverStream Application Server httpd/ v/$1/ @@ -7417,9 +7427,6 @@ match http m|^HTTP/1\.0 200 OK\r\nX-Powered-By: PHP/([-\w_.]+)\r\n.*\n(N\ match http m|^HTTP/1\.0 200 Ok\r\nServer: httpd\r\n.*<!--- Vendor:LINKSYS\nModelName:DD-WRT\n.*\nRF SSID:([^\r\n]+)\n|s p/DD-WRT milli_httpd/ i/Linksys WAP http config; SSID $1/ d/WAP/ match http m|^HTTP/1\.0 200 OK \r\n.*<title>: innovaphone (\w+)|s p/Innovaphone $1 VoIP phone http config/ d/VoIP phone/ match http m|^HTTP/1\.0 200 OK \r\n.*NAT: innovaphone (\w+)|s p/Innovaphone $1 VoIP phone http config/ d/VoIP phone/ -softmatch http m|^\n\n400 Bad Request\n\n

Bad Request

\n

Your browser sent a request that this server could not understand\.
\nReason: You're speaking plain HTTP to an SSL-enabled server port\.
\n.*

Apache/([\w._-]+) (.*) Server at ([\w._*-]+) Port \d+
|s p/Apache httpd/ v/$1/ i/$2; SSL-only mode/ h/$3/ cpe:/a:apache:http_server:$1/ -softmatch http m|^\n\n400 Bad Request\n\n

Bad Request

\n

Your browser sent a request that this server could not understand\.
\nReason: You're speaking plain HTTP to an SSL-enabled server port\.| p/Apache httpd/ i/SSL-only mode/ cpe:/a:apache:http_server/ -softmatch http m|^HTTP/1\.1 400 Bad Request\r\n.*Server: Apache\r\n.*\n\n400 Bad Request\n\n

Bad Request

\n

Your browser sent a request that this server could not understand\.
|s p/Apache httpd/ i/SSL-only mode/ cpe:/a:apache:http_server/ match http m|^HTTP/1\.1 302 Moved Temporarily\r\nDate: .*\r\nExpires: Thu, 01 Jan 1970 00:00:00 GMT\r\nSet-Cookie: SSLX_SSESHID=\w+;Path=/;Secure\r\nLocation: https://[\d.]+/showHome\.do\r\n| p/SSL Explorer browser-based VPN httpd/ i/halfd Half-Life server management/ match http m|^HTTP/1\.1 302 Moved Temporarily\r\nDate: .*\r\nContent-Type: text/html\r\nExpires: .*\r\nSet-Cookie: SSLX_SSESHID=| p/SSL Explorer browser-based VPN httpd/ match http m|^HTTP/1\.1 302 Moved Temporarily\r\nDate: .*\r\nExpires: Thu, 01 Jan 1970 00:00:00 GMT\r\nSet-Cookie: SSLX_SSESHID=| p/SSL Explorer browser-based VPN httpd/